<epigraph>
  <attribution>Dr. David Butler, British psephologist</attribution>
  <para>
    The function of the expert is not to be more right than
    other people, but to be wrong for more sophisticated reasons.
  </para>
</epigraph>

<para>
  Intended audience for this document are developers and script savvy
  administrators. But from the very beginning it also attracted people
  who sincerely care about security and view example code with suspicion.
  I'll try to explain what the source code is showing -
  or at least is supposed to show, once it's bug free and complete.
</para>

<sect2>
  <title>What exactly is a virus?</title>

  <para>
    The jargon files contain a good
    <ulink url="&jargon_virus;">definition</ulink>.
    For my purposes it is not technical enough, though.
    I want to make clear what this all is about,
    and even more important, what it is not.
  </para>

  <itemizedlist>
    <listitem>
      <para>
	A <ulink url="&jargon_virus;">virus</ulink> is a program that
	infects other programs stored in inactive form. This document
	concentrates on copying the executable code of the virus into
	another file. Other possible targets are boot sectors and
	programmable ROMs.
      </para>
    </listitem>
    <listitem>
      <para>
	A <ulink url="&jargon_worm;">worm</ulink> is a program that
	penetrates other running programs. Penetration means to copy
	the executable code of the worm into the active process image
	of the host.
      </para>
    </listitem>
    <listitem>
      <para>
	A <ulink url="&jargon_trojan;">trojan program</ulink> is
	deliberately started by a user because of advertised features,
	but performs covert malicious actions.
      </para>
    </listitem>
  </itemizedlist>

  <para>
    The jargon files include programs infected by a virus into their
    definition of trojan. I don't consider this helpful. The survival
    strategy of viruses is to stay below the level of perception of
    humans, operating systems or scanners.
    But trojans don't hide. They obfuscate their real intend by delivering
    a good show. Good advertising can persuade the user to install required
    system components, deactivate security checks, and throw aboard all
    common sense.
  </para>
  <para>
    The jargon files also claim that
    <quote>a virus cannot infect other computers without assistance</quote>.
    Widespread use of write-enabled network shares has made this a bold
    statement. It is correct that patching an executable file over
    the net is meaningless if that program is not executed somewhere.
    But I want to stress that it's not the media containing the target
    that distinguishes worms from viruses.
    A virus polluting a RAM-disk is still a virus. A worm saved to disk by
    the hibernation feature of a laptop is still a worm.
  </para>
  <para>
    The main difference between worms and viruses is persistence and
    speed.  Modifications to files are usually permanent and remain after
    reboot. On the other hand a virus attached to a host can get active
    only when that host program is started. A worm takes immediate control
    of a running process and thus can propagate very fast.
  </para>
  <para>
    Usually these techniques are combined to effectively cause mischief.
    Viruses can get resident, i.e. attach themselves to a part of the 
    system that runs independent of the infected executable.
    Worms can modify system files to leave permanent
    <ulink url="&jargon_backdoor;">back doors</ulink>.
    And tricking the user into executing the very first infector
    is a lot easier than finding and
    <ulink url="&jargon_exploit;">exploiting</ulink>
    <ulink url="&jargon_buffer_overflow;">buffer overflows</ulink>.
  </para>

</sect2>
<sect2 id="freedom_is_security" xreflabel="Freedom is security">
  <title>Freedom is security</title>

  <para>
    I will now put on a black hat and an evil grin.
    Using material already published on the net, contributions sent to me,
    and all documentation available, I will try to build a virus to do in
    Linux for good.
    All concepts, ideas and experiments - along with enough working code
    to prove my conclusions - will be released to public ridicule
    through this document.
  </para>

  <para>
    Should the quest fail this may have a few reasons:
  </para>
  <orderedlist>
    <listitem>
      <para>I am incompetent.</para>
    </listitem>
    <listitem>
      <para>Nobody cared to sent in evidence for #1.</para>
    </listitem>
    <listitem>
      <para>
        It already has been done,
	but They will prevent #2 to maintain #1. 
      </para>
    </listitem>
    <listitem>
      <para>
	Optimistic readers could think that the inevitable big mistake of
	developers and distributors will be released soon, but just isn't
	available right now.
      </para>
    </listitem>
    <listitem>
      <para>
	Even more adventurous spectators might say that design,
	development model, or distribution concept make Linux
	immune against a direct attack.
      </para>
    </listitem>
    <listitem>
      <para>
        This is just one of the more boring episodes in the matrix.
      </para>
    </listitem>
  </orderedlist>

  <para>
    Anyway, it is not a problem if we, or someone using this document,
    succeeds. The correct name for that situation is opportunity.
  </para>

  <para>
    Should you happen to take this document - and especially above agenda -
    too seriously, a look at
    <ulink url="&vmyths_osama;">Osama bin virus</ulink>
    on <ulink url="&vmyths;">&vmyths;</ulink> can help.
  </para>
  <para>
    This text written under influence of an evil grin.
  </para>

</sect2>
